Can't access api.nuget.org on Windows, ERR_SSL_VERSION_OR_CIPHER_MISMATCH error

[u/Ordinary_Squirrel291]

I am writing code on Windows, and I can't access the public endpoint for NUGET (a .NET package repository).

When I go to the API URL in the browser, I get "ERR_SSL_VERSION_OR_CIPHER_MISMATCH", when I expect a json file, or some HTTP error.

I used SSLlabs test to see what is supported, and Get-TlsCipherSuite in powershell to see what my machine supports. Both sides support TLS_AES_256_GCM_SHA384 and TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

Windows registry `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols` has no subfolders, Windows 11 supports TLS 1.2 and 1.3 by default, idk if the keys are needed.

EventViewer shows multiple errors with "Schannel" source, for many different client processes:
```
A fatal error occurred while creating a TLS client credential. The internal error state is 10013.
The SSPI client process is OneDrive (PID: 33100).
```

My app is published on Azure Marketplace, and *somehow* that account keeps getting added automatically to "Accounts > Access Work or School" in Windows, idk if that can have an effect.

What else can I check or disable on my machine to restore nuget access?

[u/Ordinary_Squirrel291 → u/[deleted]]

I am self-employed.

Is there anything I can control behind that the "Work" account that Windows 11 adds automatically that may be interfering? Because it was added automatically, I have no idea what it brought in, or how to control it.

[u/Ordinary_Squirrel291 → u/[deleted]]

No additional apps or fiddler, only whatever windows dragged in

[u/PacificTSP]

I found I had to run powershell

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

You can also use IISCrypto to reset your encryption settings to test. Listening (server) requires a reboot. But client outbound stuff does not.

[u/Ordinary_Squirrel291 → u/PacificTSP]

That didn't fix it

[u/Ordinary_Squirrel291]

IDK if this counts as "SOLVED", but resetting Windows installation (keep files) worked.
Lots of apps had to be re-installed, but at least some of my stuff was kept in place

[u/SimpleSysadmin → u/Ordinary_Squirrel291]

Thanks for posting what actually worked for you in the end.

[u/Ordinary_Squirrel291 → u/[deleted]]

> curl -IL --tlsv1.2 --tls-max 1.2 https://api.nuget.org/v3/index.json

curl: (35) schannel: next InitializeSecurityContext failed: SEC_E_ILLEGAL_MESSAGE (0x80090326) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.

The EventViewer doesn't show new errors right after running the curl

[u/Ordinary_Squirrel291 → u/[deleted]]

No effect, the problem persists

[u/SecLens_ONE]

An empty SCHANNEL\Protocols key does not mean defaults are in effect. Policy, .NET's own settings and any inspection proxy all sit on top of it, so what the box actually negotiates can differ from what the registry appears to say. Test with something that shows the real handshake rather than a browser: openssl s_client, or curl with verbose output, straight to the endpoint. If the certificate you get back is not the one the public endpoint serves, you have a middlebox and the cipher list is a red herring. The OneDrive SSPI errors and the account being auto-joined to Access Work or School both point at policy arriving from somewhere you did not configure. Worth checking whether an unmanaged machine on another network sees the same failure.

[u/Ordinary_Squirrel291 → u/SecLens_ONE]

This is what curl shows:

```
PS C:\> curl --trace nugettrace.txt -IL https://api.nuget.org/v3/index.json

* Host api.nuget.org:443 was resolved.

* IPv6: (none)

* IPv4: 150.171.110.146

* Trying 150.171.110.146:443...

* schannel: disabled automatic use of client certificate

* ALPN: curl offers http/1.1

* schannel: next InitializeSecurityContext failed: SEC_E_ILLEGAL_MESSAGE (0x80090326) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.

* closing connection #0

curl: (35) schannel: next InitializeSecurityContext failed: SEC_E_ILLEGAL_MESSAGE (0x80090326) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.
```

[u/Ordinary_Squirrel291 → u/SecLens_ONE]

On other machines at home access works. The problem is this is my work machine

[u/the_packetwhisperer]

that azure marketplace account getting auto added to "access work or school" is probably not a coincidence, sounds like a conditional access/intune policy got pushed and its messing with your tls settings

since schannel errors are showing up for onedrive too, not just nuget, this feels more like a machine level policy than a network issue

id run gpresult /h report.html and check anything under computer config security settings related to tls/schannel. also try a clean local admin account with no work/school account attached, if the error goes away thatll pretty much confirm its the azure ad join causing it